telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.

According to the versions of the telnet package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer     dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but     the telnet service would remain available through inetd. However, if the telnetd application has many     crashes within a short time interval, the telnet service would become unavailable after inetd logs a     'telnet/tcp server failing (looping), service terminated' error. NOTE: MIT krb5-appl is not supported     upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT     Kerberos 5 (aka krb5) product many years ago, at version 1.8.(CVE-2022-39028)

Tenable has extracted the preceding description block directly from the EulerOS telnet security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6304-1 advisory.

  - telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer     dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but     the telnet service would remain available through inetd. However, if the telnetd application has many     crashes within a short time interval, the telnet service would become unavailable after inetd logs a     telnet/tcp server failing (looping), service terminated error. NOTE: MIT krb5-appl is not supported     upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT     Kerberos 5 (aka krb5) product many years ago, at version 1.8. (CVE-2022-39028)

  - GNU inetutils through 2.4 may allow privilege escalation because of unchecked return values of set*id()     family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for example, relevant if the setuid     system call fails when a process is trying to drop privileges before letting an ordinary user control the     activities of the process. (CVE-2023-40303)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3205 advisory.

  - Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to     stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS. A stack-     based overflow is present in the handling of environment variables when connecting via the telnet client     to remote telnet servers. This issue only affects the telnet client  accessible from the CLI or shell     in Junos OS. Inbound telnet services are not affected by this issue. This issue affects: Juniper Networks     Junos OS: 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions     prior to 14.1X53-D130, 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X49 versions prior     to 15.1X49-D170; 15.1X53 versions prior to 15.1X53-D237, 15.1X53-D496, 15.1X53-D591, 15.1X53-D69; 16.1     versions prior to 16.1R3-S11, 16.1R7-S4; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3;
    17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions     prior to 17.4R1-S6, 17.4R2-S3, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to     18.2R1-S5, 18.2R2-S2, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3,     18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2. (CVE-2019-0053)

  - A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to     a given IP address and port, and this way potentially make curl extract information about services that     are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
    (CVE-2020-8284)

  - The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to     make sure they match the server address. This is similar to CVE-2020-8284 for curl. (CVE-2021-40491)

  - telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer     dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but     the telnet service would remain available through inetd. However, if the telnetd application has many     crashes within a short time interval, the telnet service would become unavailable after inetd logs a     telnet/tcp server failing (looping), service terminated error. NOTE: MIT krb5-appl is not supported     upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT     Kerberos 5 (aka krb5) product many years ago, at version 1.8. (CVE-2022-39028)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3783-1 advisory.

  - telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer     dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but     the telnet service would remain available through inetd. However, if the telnetd application has many     crashes within a short time interval, the telnet service would become unavailable after inetd logs a     telnet/tcp server failing (looping), service terminated error. NOTE: MIT krb5-appl is not supported     upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT     Kerberos 5 (aka krb5) product many years ago, at version 1.8. (CVE-2022-39028)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3735-1 advisory.

  - telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer     dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but     the telnet service would remain available through inetd. However, if the telnetd application has many     crashes within a short time interval, the telnet service would become unavailable after inetd logs a     telnet/tcp server failing (looping), service terminated error. NOTE: MIT krb5-appl is not supported     upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT     Kerberos 5 (aka krb5) product many years ago, at version 1.8. (CVE-2022-39028)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3471-1 advisory.

  - telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer     dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but     the telnet service would remain available through inetd. However, if the telnetd application has many     crashes within a short time interval, the telnet service would become unavailable after inetd logs a     telnet/tcp server failing (looping), service terminated error. NOTE: MIT krb5-appl is not supported     upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT     Kerberos 5 (aka krb5) product many years ago, at version 1.8. (CVE-2022-39028)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202527	EulerOS 2.0 SP9 : telnet (EulerOS-SA-2024-1975)	Nessus	Huawei Local Security Checks	high
202518	EulerOS 2.0 SP9 : telnet (EulerOS-SA-2024-1948)	Nessus	Huawei Local Security Checks	high
180029	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Inetutils vulnerabilities (USN-6304-1)	Nessus	Ubuntu Local Security Checks	high
168204	Debian DLA-3205-1 : inetutils - LTS security update	Nessus	Debian Local Security Checks	high
166683	SUSE SLED15 / SLES15 Security Update : telnet (SUSE-SU-2022:3783-1)	Nessus	SuSE Local Security Checks	high
166580	SUSE SLES12 Security Update : telnet (SUSE-SU-2022:3735-1)	Nessus	SuSE Local Security Checks	high
165577	SUSE SLES12 Security Update : krb5-appl (SUSE-SU-2022:3471-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2022-39028

high

Tenable Plugins

high

high

high

high

high

high

high